fwaccel dbg

Description

The fwaccel dbg command controls the SecureXL Check Point product on a Security Gateway that accelerates IPv4 and IPv6 traffic that passes through a Security Gateway. debug. See SecureXL Debug Procedure.

Important:

In a Cluster Two or more Security Gateways that work together in a redundant configuration - High Availability, or Load Sharing., you must configure all the Cluster Members in the same way.
On Scalable Platforms (Maestro and Chassis), you must connect to the applicable Security Group.
If you do not use the complete debug procedure with the "fw ctl kdebug" command,

and SecureXL works in Kernel Mode (KPPAK), then Security Gateway Dedicated Check Point server that runs Check Point software to inspect traffic and enforce Security Policies for connected network resources. writes the debug outputs to these files:
- $FWDIR/log/fwk.elg - Processing of traffic in the Firewall module
- /var/log/messages - Additional information
If you do not use the complete debug procedure with the "fw ctl kdebug" command,

and SecureXL works in User Mode (UPPAK), then Security Gateway writes the debug outputs to these files:
- $FWDIR/log/fwk.elg - Processing of traffic in the Firewall module
- /var/log/usim_x86.elg - Processing of traffic in SecureXL
- /var/log/messages - Processing of traffic in the ADP module (NVIDIA ConnectX 100G Cards)

Syntax in Gaia Clish or the Expert mode on a Security Gateway / ClusterXL:

fwaccel dbg

-h

-m <Name of SecureXL Debug Module>

all

+ <Debug Flags>

- <Debug Flags>

reset

-f {"<5-Tuple Debug Filter>" | reset}

list

resetall

Syntax in Gaia gClish on a Scalable Platform Security Group:

fwaccel dbg

-h

-m <Name of SecureXL Debug Module>

all

+ <Debug Flags>

- <Debug Flags>

reset

-f {"<5-Tuple Debug Filter>" | reset}

list

resetall

Syntax in the Expert mode on a Scalable Platform Security Group:

g_fwaccel dbg

-h

-m <Name of SecureXL Debug Module>

all

+ <Debug Flags>

- <Debug Flags>

reset

-f {"<5-Tuple Debug Filter>" | reset}

list

resetall

Parameters

Parameter

Description

-h

Shows the applicable built-in help.

-m <Name of SecureXL Debug Module>

Specifies the name of the SecureXL debug module.

To see the list of available debug modules, run:

fwaccel dbg

all

Enables all debug flags for the specified debug module.

+ <Debug Flags>

Enables the specified debug flags for the specified debug module:

Syntax:

+ Flag1 [Flag2 Flag3 ... FlagN]

Note - You must press the space bar key after the plus (+) character.

- <Debug Flags>

Disables all debug flags for the specified debug module.

Syntax:

- Flag1 [Flag2 Flag3 ... FlagN]

Note - You must press the space bar key after the minus (-) character.

reset

Resets all debug flags for the specified debug module to their default state.

-f "<5-Tuple Debug Filter>"

Configures the debug filter to show only debug messages that contain the specified connection.

The filter is a string of five numbers separated with commas:

"<Source IP Address>,<Source Port>,<Destination IP Address>,<Destination Port>,<Protocol Number>"

Notes:

You can configure only one debug filter at one time.
You can use the asterisk "*" as a wildcard for an IP Address, Port number, or Protocol number.
For more information, see IANA Service Name and Port Number Registry and IANA Protocol Numbers.

-f reset

Resets the current debug filter.

list

Shows all enabled debug flags in all debug modules.

resetall

Reset all debug flags for all debug modules to their default state.

Enabling SecureXL debug flags during boot

From R81.20, you can configure SecureXL debug to start during boot.

Important - In a Cluster, you must configure all the Cluster Members in the same way.

Procedure

Step

Instructions

Connect to the command line on the Security Gateway / each Cluster Member Security Gateway that is part of a cluster..

On Scalable Platforms (Maestro and Chassis), you must connect to the applicable Security Group.

Create the require configuration files:

To collect the debug for IPv4 traffic:

touch $FWDIR/conf/fwaccel_dbg_flags.cfg

To collect the debug for IPv6 traffic:

touch $FWDIR/conf/fwaccel6_dbg_flags.cfg

Edit the applicable configuration file:

To collect the debug for IPv4 traffic:

vi $FWDIR/conf/fwaccel_dbg_flags.cfg

To collect the debug for IPv6 traffic:

vi $FWDIR/conf/fwaccel6_dbg_flags.cfg

Configure the applicable debug modules and the debug flags (see R81.20 Quantum Security Gateway Guide).

Write each debug module and its flags on a separate line:

<Name of Debug Module #1> <Flag1> <Flag2> <Flag3> ... <FlagN>

<Name of Debug Module #2> <Flag1> <Flag2> <Flag3> ... <FlagN>

Example:

default conn nat

pkt drop nat

Save the changes in the file and exit the editor.

On the Scalable Platform Security Group, you must copy the updated file to all Security Group Members:

asg_cp2blades $FWDIR/conf/fwaccel_dbg_flags.cfg

asg_cp2blades $FWDIR/conf/fwaccel6_dbg_flags.cfg

Reboot the Security Gateway / each Cluster Member / all Security Group Members.

Wait for the issue to occur.

Connect to the command line on the Security Gateway / each Cluster Member.

On Scalable Platforms (Maestro and Chassis), you must connect to the applicable Security Group.

Reset all the SecureXL debug flags in all SecureXL debug modules:

On the Security Gateway / each Cluster Member:

fwaccel dbg resetall

On the Scalable Platform Security Group:

g_fwaccel dbg resetall

Remove all entries from the configuration files:

On the Security Gateway / each Cluster Member:

echo '' > $FWDIR/conf/fwaccel_dbg_flags.cfg

echo '' > $FWDIR/conf/fwaccel6_dbg_flags.cfg

On the Scalable Platform Security Group:

echo '' > $FWDIR/conf/fwaccel_dbg_flags.cfg

asg_cp2blades $FWDIR/conf/fwaccel_dbg_flags.cfg

echo '' > $FWDIR/conf/fwaccel6_dbg_flags.cfg

asg_cp2blades $FWDIR/conf/fwaccel6_dbg_flags.cfg

Collect the output files.

If SecureXL works in Kernel Mode (KPPAK):

$FWDIR/log/fwk.elg
/var/log/messages

If SecureXL works in User Mode (UPPAK):

$FWDIR/log/fwk.elg
/var/log/usim_x86.elg
/var/log/messages

Examples

Example 1 - Default output

[Expert@MyGW:0]# fwaccel dbg
Usage: fwaccel dbg [-m <...>] [resetall | reset | list | all | +/- <flags>]
   -m <module>             - module of debugging
   -h                      - this help message
   resetall                - reset all debug flags for all modules
   reset                   - reset all debug flags for module
   all                     - set all debug flags for module
   list                    - list all debug flags for all modules
   -f reset | "<5-tuple>"  - filter debug messages
   + <flags>               - set the given debug flags
   - <flags>               - unset the given debug flags

Debug flags can be enabled at boot by adding them to
$FWDIR/conf/fwaccel_dbg_flags.cfg and $FWDIR/conf/fwaccel6_dbg_flags.cfg.
The file format is one line per module.

For example, to enable "tcp_state" and "routing" for the "pkt" module:
    echo "pkt tcp_state routing" >> $FWDIR/conf/fwaccel_dbg_flags.cfg

List of available modules and flags:

Module: default (default)
init drv tag lock cpdrv routing kdrv tcp_sv svm iter conn htab del update acct conf stat queue ioctl corr util rngs relations ant conn_app rngs_print infra_ids offload nat

Module: db
get save del tmpl tmo init ant profile nmr nmt warning

Module: api
init add update del acct conf stat vpn notif tmpl sv pxl qos gtp infra tmpl_info upd_conf upd_if_inf add_sa del_sa del_all_sas misc get_features get_tab get_stat reset_stat tag long_ver del_all_tmpl get_state upd_link_sel

Module: pkt
f2f frag spoof acct notif tcp_state tcp_state_pkt sv cpls routing drop pxl qos user deliver vlan pkt nat wrp corr caf bhm geneve sctp

Module: infras
reorder pm

Module: tmpl
dtmpl_get dtmpl_notif tmpl

Module: vpn
vpnpkt linksel routing vpn ls

Module: nac
db db_get pkt pkt_ex signature offload idnt ioctl nac

Module: cpaq
init client server exp cbuf opreg transport transport_utils broadcast

Module: synatk
init conf conn log pkt proxy state msg

Module: adp
rt nh eth heth wrp inf mbs bpl bplinf mbeinf if drop bond xmode ipsctl ac_print cpfifo qconf qcomm filter packet mcast hw_offload hw_expn rte_api

Module: dos
fw1-cfg fw1-pkt sim-cfg sim-pkt detailed-pkt detailed-cfg drop cache

Module: gtp
pkt policy tables api drop notif general

Module: usdisp
error conn packet api msg state packet_err counter event quota ioctl lock clb uid queue fwstats cachetab vpn temp_conns prio route dumbo

Module: dpdk_lib


Module: dpdk_pmd


Module: dpdk_other


[Expert@MyGW:0]#